Archive | SharePoint 13 RSS feed for this section

SharePoint 2013 Service Accounts Best Practices


Source: http://www.absolute-sharepoint.com/2013/01/sharepoint-2013-service-accounts-best.html
You can download all the information here in PDF format on  here: http://sdrv.ms/U6hvuU

For the SQL Server

Name Description Local Rights Domain Rights
SQL_Admin The SQL Server service account is used to run SQL Server. It is the service account for the following SQL Server services: MSSQLSERVER SQLSERVERAGENT. SQL Admin on the SQL Server Local Administrator on the SQL Server Domain User

Explanation

As Stated previously, in the Low Security Option, we only use one Service Account for our SQL Server.  This account needs to be a Local Administrator on the SQL server in order to be able to install SQL. We will also run the SQL AGENT and the Database Engine services with this account.  This the account that will have the full power on your SQL server and you will use it to grant rights to your SP_Farm(more details to follow)

For the SharePoint Server

 

Name Description Local Rights Domain Rights
SP_Farm The server farm account is used to perform the following tasks:

-Setup
-SharePoint Products Configuration Wizard
-Configure and manage the server farm.
-Act as the application pool identity for the SharePoint Central Administration Web site.
-Run the Microsoft SharePoint Foundation Workflow Timer Service.
Local Administrator on all the SharePoint Servers. SecurityAdmin and DB_Creator rights on the SQL Instance Domain User
SP_Pool The Pool account is used to run the Web Application Pools None Domain User
SP_Services The Services Account is used to run the Service Application Pool None Domain User
SP_Crawl The Default Content Access Account for the Search Service Application None Domain User
SP_UserProfiles The User Profile Synchronization Account None Replicate Directory Changes permission on the domain. Guide:http://bit.ly/TSE7xs

Explanation

The Low Security Option uses the minimum amount of accounts while also keeping a level of security.  Here is the account breakdown:
SP_Farm is your main SharePoint account in this configuration. It needs to have Local Administrator rights to be able to install SharePoint Server and also the Securityadmin and DBcreator roles on the SQL Server to create the configuration and other databases.  This account will be your main Farm Administrator and also run the Timer Service and the web application for Central Administration use to access the SharePoint content database
SP_Pool  is a domain account used for application pool identity.. ex: When you create a Web Application, and you create a pool for it, you select this account!

SP_Services is a domain account used for the Service Applications Pools.  ex: When you create a Managed Metadata Service application and create a pool for it, you select this account!

SP_Crawl is used within the Search Service Application  to crawl content. The Search Service Application will automatically grant this account read access on all Web Applications. It will also run the SharePoint Windows Search Service.

SP_UserProfiles is the account used for the User Profile Synchronization between your Service Application and your Active Directory. This account does not need any local rights, however you need to give it Replicate Directory Changes rights on the Active Directory in order to allow the synchronization

Medium Security Option (Sweet Spot)

SUMMARY

The Medium Security option is the Sweet Spot of a SharePoint installation. It uses slightly more accounts than the Low Security Option however it provides a huge security improvement. By giving less rights to each account you limit the possible damage in case an account gets hacked  and also follow Microsoft’s recommendation of installing SharePoint 2013 with  least-privilege administration. More details on the changes under every section!

For the SQL Server

 

Name Description Local Rights Domain Rights
SQL_Admin SQL Admin on the SQL Server. Used to Install the SQL Server. Local Administrator on the SQL Server Domain User
SQL_Services It is the service account for the following SQL Server services: MSSQLSERVER SQLSERVERAGENT. None Domain User

Explanation

The difference between the Low Security and the Medium Security option for the SQL is that we now use two different accounts :The SQL_Admin and the SQL_Services. The big security improvement is that the account running the Agent and Database Engine services is not a local administrator anymore. Here is the account breakdown:
SQL_Admin: This will be your main SQL Administrator!. It needs Local Administrator rights in order to install the SQL server.
SQL_Services: This account does not have any local rights, it is only used to run the SQL Agent and Database Engine windows services.

For the SharePoint Server

 

Name Description Local Rights Domain Rights
SP_Farm The server farm account is used to perform the following tasks:

-Configure and manage the server farm.
-Act as the application pool identity for the SharePoint Central Administration Web site.
-Run the Microsoft SharePoint Foundation Workflow Timer Service.
SecurityAdmin and DB_Creator rights on the SQL Instance Domain User
SP_Admin The server farm account is used to perform the following tasks:

-Setup
-SharePoint Products Configuration Wizard
Local Administrator on all the SharePoint Servers. SecurityAdmin and DB_Creator rights on the SQL Instance Domain User
SP_Pool The Pool account is used to run the Web Application Pools None Domain User
SP_Services The Services Account is used to run the Service Application Pool None Domain User
SP_Crawl The Default Content Access Account for the Search Service Application None Domain User
SP_Search Service Account to run the SharePoint Search “Windows Service” None Domain User
SP_UserProfiles The User Profile Synchronization Account None Replicate Directory Changes permission on the domain. Guide:http://bit.ly/TSE7xs

Explanation

In the Medium Security option we increase the security by adding two new accounts: The SP_Admin and the SP_Search. Instead of giving all the Farm Administration power to the SP_Farm account, the SP_Admin will be the one that installs and configures SharePoint 2013 and have the local administrator rights, while the SP_Farm will only run the services and connect to the database. Furthermore, instead of letting the SP_Crawl account run both the Windows Service and have FULL-READ rights on all the web applications, the SP_Search will now run the Windows Service. Here is the breakdown of the accounts:

SP_Farm is a domain account that the SharePoint Timer service and the web application for Central Administration use to access the SharePoint content database. This account does not need to be a local administrator. The SharePoint configuration wizard grants the proper minimal privilege in the back-end SQL Server database.The minimum SQL Server privilege configuration is membership in the roles securityadmin and dbcreator.

SP_admin is a domain account you use to install and configure the farm. It is the account used to run the SharePoint Configuration Wizard  for SharePoint 2013.The SPAdmin account is the only account that requires local Administrator rights. To configure the SPAdmin account in a minimum privilege scenario, it should be a member of the roles securityadmin and dbcreator on the SQL server.

SP_Pool  is a domain account used for application pool identity.. ex: When you create a Web Application, and you create a pool for it, you select this account!

SP_Services is a domain account used for the Service Applications Pools.  ex: When you create a Managed Metadata Service application and create a pool for it, you select this account!

SP_Crawl is used within the Search Service Application  to crawl content. The Search Service Application will automatically grant this account read access on all Web Applications.

SP_Search Is used to run the SharePoint Windows Search Service.

SP_UserProfiles is the account used for the User Profile Synchronization between your Service Application and your Active Directory. This account does not need any local rights, however you need to give it Replicate Directory Changes rights on the Active Directory in order to allow the synchronization.

High Security Option

SUMMARY

The High Security Option is the ones that provides the best security and of course the most Service Accounts. This only ads a small amount of extra security to the farm, however that extra security might be needed in some scenarios

For the SQL Server

 

Name Description Local Rights Domain Rights
SQL_Admin SQL Admin on the SQL Server. Used to Install the SQL Server. Local Administrator on the SQL Server Domain User
SQL_AGENT It is the service account for the following SQL Server services: SQL SERVER AGENT. None Domain User
SQL_ENGINE It is the service account for the following SQL Server services: Database Engine. None Domain User

Explanation

The difference between the Medium Security and High Security Option is that we now have a separate account for each of the two base services: SQL_Agent and Database Engine.  Nothing changes for the SQL_Admin

SQL_Admin: This will be your main SQL Administrator!. It needs Local Administrator rights in order to install the SQL server.
SQL_Agent: This account does not have any local rights, it is only used to run the SQL Agent Windows Service

SQL_Engine: This account does not have any local rights, it is only used to run the Database Engine windows service.

 

For the SharePoint Server

 

Name Description Local Rights Domain Rights
SP_Farm The server farm account is used to perform the following tasks:

-Configure and manage the server farm.
-Act as the application pool identity for the SharePoint Central Administration Web site.
-Run the Microsoft SharePoint Foundation Workflow Timer Service.
SecurityAdmin and DB_Creator rights on the SQL Instance Domain User
SP_Admin The server farm account is used to perform the following tasks:

-Setup
-SharePoint Products Configuration Wizard
Local Administrator on all the SharePoint Servers. SecurityAdmin and DB_Creator rights on the SQL Instance Domain User
SP_Pool The Pool account is used to run the Web Application Pools None Domain User
SP_Services The Services Account is used to run the Service Application Pool None Domain User
SP_Crawl The Default Content Access Account for the Search Service Application None Domain User
SP_Search Service Account to run the SharePoint Search “Windows Service” None Domain User
Sp_MySitePool Used for the My Sites Web Application None Domain User
SP_UserProfiles The User Profile Synchronization Account None Replicate Directory Changes permission on the domain. Guide:http://bit.ly/TSE7xs

Explanation

The only difference between the Medium security and the High Security option is that we now have a separate account for the Web Application Pool hosting the ‘My Sites’  since it has a different security policy than the other Web Applications .  I will only give the details for the new account in the breakdown:

SP_MySitePool  is a domain account used for the My Sites Web Application Pool Identity. It’s very similar to the SP_Pool, however it is only used for the My Sites Web Application.

Source: http://www.absolute-sharepoint.com/2013/01/sharepoint-2013-service-accounts-best.html
You can download all the information here in PDF format on  here: http://sdrv.ms/U6hvuU

Upgrade from Office SharePoint Server 2007 to SharePoint Server 2013


Can I upgrade from Office SharePoint Server 2007 to SharePoint Server 2013?

Not directly, but you can do what we call a “double-hop” database attach to upgrade from Office SharePoint Server 2007 to SharePoint Server 2010, and then from SharePoint Server 2010 to SharePoint Server 2013. Back up your content databases from 2007, set up a small, temporary farm with SharePoint 2010 (you can even use virtual servers if you don’t have space, and a trial version), and attach and upgrade them to 2010 there. Then, set up your destination 2013 farm, back up the 2010 databases, and attach and upgrade them to SharePoint 2013.

This upgrade path also applies to upgrading from Windows SharePoint Services 3.0 to SharePoint Foundation 2013 – you must upgrade to SharePoint Foundation 2010 before you go to SharePoint Foundation 2013.

I don’t have an article about this “double-hop” upgrade path just yet, but I am working on getting one out there as soon as I can.

Source: http://blogs.technet.com/b/tothesharepoint/archive/2012/11/19/upgrade-frequent-questions-from-sharepoint-conference-2012.aspx

SharePoint 2013 Upgrade Process


This model explains the process that you use when you upgrade from SharePoint Foundation 2010 or SharePoint Server 2010 to SharePoint Foundation 2013 or SharePoint Server 2013.

http://www.microsoft.com/en-us/download/details.aspx?id=30371

Modify the Title of the Global Navigation in SharePoint 2013 with PowerShell


Source: http://www.fiechter.eu/blog/Lists/Posts/Post.aspx?ID=27&mobile=0
By Adrian Fiechter

The new global navigation in SharePoint 2013 looks very promising, anyway I assume that many persons out there want to change it. Especially the “SharePoint” title.

There are different approachs which can be considered to change the global navigation. For example, changing the Mastpages, using the newly introduced Design Packages or doing some dirty java script hacks. All of them are giving an impression as this is a complete overkill for such a small issue. The good news, it is.

Before the script:

After the script:

Microsoft has actually added a new property to the web application which allows us to replace the SharePoint text with custom HTML by PowerShell or object model.

With the following script you can change it and add your custom HTML there:

$app = Get-SPWebApplication -Identity https://www.fiechter.eu

$app.SuiteBarBrandingElementHtml = “<div class=’ms-core-brandingText’>AdriansPoint</div>”

$app.Update()

Source: http://www.fiechter.eu/blog/Lists/Posts/Post.aspx?ID=27&mobile=0
By Adrian Fiechter

Google Analytics for SharePoint 2013 / Office 365


How to setup Google Analytics for SharePoint 2013? Excellent article by  Adrian Fiechter explain how it can be done
Source Link: http://www.fiechter.eu/blog/Lists/Posts/Post.aspx?ID=34&mobile=0

nstallation:

  1. Open your SharePoint 2013 site collection or your public website
  2. Rename the URL in the browser (Login as needed with a site collection administrator / your admin account):

    Current URL: http://www.fiechter.eu/about-us

    Rename to: http://www.fiechter.eu/_catalogs/solutions

    Note: Somehow Microsoft has removed the possibility to show the sandbox solutions folder from the UI in public websites. Anyway as they are using it for design packages and website templates, I assume there will be no difficulties with no-code sandbox solutions.

  3. Select Upload Solution

  4. Select Browse… 

  5. Download the solution package, extract it and upload the wsp file:http://www.fiechter.eu/blog/Solutions/Wsp365.GoogleAnalytics.zip

  6. Click Open and OK to upload the solution.

     

  7. Select Activate to install the solution.

  8. Now, verify the activation was successfully 
  9. Finally you have to add your Google Analytics code. For that you can open Site Settings:

  10. There is a new menu entry point under Site Collection Administration which is called Google Analytics

     

  11. Paste the google analytics code into the red square and press OK. That’s it.

To test if it works as expected, just open the website in a different browser and take a look on the html source. If your Google Analytics code is there, then everything is fine.

If you are unhappy with the solution, then just deactivate the sandbox solution over the same URL. As there is no modification on existing sites done, your site will work as before.


How to setup Google Analytics for SharePoint 2013? Excellent article by  Adrian Fiechter explain how it can be done
Source Link: http://www.fiechter.eu/blog/Lists/Posts/Post.aspx?ID=34&mobile=0

Configure the Secure Store Service in SharePoint 2013 Preview


To configure Secure Store, you perform the following steps:

1. Register a managed account in SharePoint Server 2013 Preview to run the Secure Store application pool.

2. Start the Secure Store Service on an application server in the farm.

3. Create a Secure Store Service service application.

To run the application pool, you must have a standard domain account. No specific permissions are required for this account. Once the account has been created in Active Directory, follow these steps to register it with SharePoint Server 2013 Preview

 

To register a managed account

1. On the SharePoint Central Administration Web site home page, in the left navigation, click Security.

SharePoint 2013 Security

2. On the Security page, in the General Security section, click Configure managed accounts.

Configure Managed Accounts in SharePoint 2013

3. On the Managed Accounts page, click Register Managed Account.

4. In the User name box, type the name of the account.

Register Managed Account in SharePoint 13

5. In the Password box, type the password for the YourDomain\ServicePool account.

6. If you want SharePoint Server 2013 Preview to handle changing the password for the account, select the Enable automatic password change box and specify the password change parameters that you want to use.

7. Click OK.

Installing SharePoint 2013 Preview in Windows 7


All the steps you needed to install and configure SharePoint 2012 Preview in Windows 7 operating system

http://virtualizesharepoint.com/2012/07/23/install-sharepoint-2013-in-virtual-machine/

The Managed Metadata Service or Connection is currently not available – SharePoint 2013


The Managed Metadata Service or Connection is currently not available. The Application Pool or Managed Metadata Web Service may not have been started. Please Contact Your Administrator

View the steps about how you can resolve The Managed Metadata Service or Connection is currently not available -in SharePoint 2013

SharePoint 2013 and Garbage Collection


SharePoint 2007 and 2012 are memory monsters, also the SQL Server. SharePoint and SQL Server combination on a production server gave so many sleepless nights and nightmares in day time to many IT Pros. One of the application I was building in the past also had many problems related to memory. After drilling down into the roots I found that much of the processor and memory is occupied by SharePoint i.e ASP.Net i.e w3p.exe.

Read More:http://www.shailwx.com/2012/07/sharepoint-2013-net-framework-4-0-and-garbage-collection/

Installing SharePoint 2013 Step by step


Install and configure SharePoint 2013 in Windows 2012 Server with SQL Server 2012. 
See my other post about how to install and configure Windows 2012 and SQL 2012

1. Open SharePoint 2012 Setup file and Install Software Prerequisites for SharePoint 2013

install_sharepoint_server_2013_prerequisites

 

2. Welcome to the Microsoft SharePoint 2013 Preview Product Preparation Tool
SharePoint 2013 preview products preparation tool checks your computer for required products and updates. It may connect to the internet to download products from the Microsoft download center.
tool installs and configures the following products. Click next to install Microsoft SharePoint 2013 Preview  prerequisites

sharepoint_2013_preview_products_preparation_tool_9

3. Microsoft SharePoint 2013 Preview prerequisites have been installed or enabled. Restart the computer before you can start SharePoint 2013 installation

sharepoint_2013_preview_products_preparation_completed_12

4. Click on Install SharePoint Server 2013

Install_SharePoint_Server_2013_Preview_12

5. Please wait while setup prepares the necessary files

Install_SharePoint_Server_2013_Preview_13

6. Enter your product key to install SharePoint Server 2013

Install_SharePoint_Server_2013_Preview

 

7. Read the Microsoft Software Licence Terms and click continue

SharePoint Server 2013 Preview License Terms

 

8. Choose a file location
SharePoint Server 2013 preview will be installed on your computer. To install this product in a different location, Click Browse, and then select the location

SharePoint Server 2013 preview File Location

9.SharePoint Server 2013 preview Installation Progress

SharePoint Server 2013 preview Installation Progress

10. Run Configuration Wizard : To complete configuration of your server, you must run the SharePoint Products configuration Wizard

SharePoint Server 2013 Preview Configuration Wizard

11. Welcome to SharePoint Products Configuration Wizard. Click Next

SharePoint 2013 products configuration wizard

 

12. Create a new server farm

SharePoint 2013- Create a new server farm

13.  Specify configuration database settings

SharePoint 2013 configuration Database Settings

14. Specify Farm Security Settings

SharePoint 2013 Farm Security Settings

 

15. Configure SharePoint Central Administration Web Application

Configure SharePoint 2013 Central Administration Web Application

16. Complete the SharePoint Products Configuration Wizard

completing sharepoint 2013 configuration wizard

17. Configuration Successful.  Click Finish

SharePoint 2013 configuration sucessful

18. Configure your SharePoint farm by start the wizard

SharePoint 2013 configuration wizard

19. Use your farm admin account and the services you want to install

SharePoint 2013 Service Accounts

20. Once the installation completes, select the template for your site

SharePoint 2012 Collaboration Tempalte

21. This completes the farm configuration wizard and your SharePoint farm is available for testing

SharePoint 2013 completes configuration wizard

Install SharePoint 2013 in Virtual Machine


How to install and configure SharePoint 2013 in virtual environment using VirtualBox?
In this post you will find all the steps need to build SharePoint 2013 virtual environment in Windows 2012 server with SQL 2012

My Environment:

RAM: 12 GB
Disk: 200GB
Desktop: Core i5
Operating System: Windows 7 64 bit

1.  Download Virtualbox and create a virtual machine.

2. My settings for SharePoint 2013 Development Environment contain (Windows 2012 Server, SQL 2012 Server and SharePoint 2013)

image

 

3. Install Windows 2012 in the new Virtual Machine. You can download Windows 2012 Release Candidate from :

Download Windows Server 2012 Release Candidate (RC)

 

4. Once you install Windows 2012 Release Candidate, setup Active Directory, DNS and setup all the accounts you needed for SharePoint Installation.
See my other post about how to install and configure Active Directory

Install and Configure Active Directory in Windows 2012 Release Candidate
Create new users accounts in Active Directory in Windows 2012 Release Candidate

You need following accounts for SharePoint Installation:

Account Purpose Requirements
SQL Server service account

create_sharepoint_sql_account-3

The SQL Server service account is used to run SQL Server. It is the service account for the following SQL Server services:

MSSQLSERVER

SQLSERVERAGENT

If you do not use the default SQL Server instance, in the Windows Services console, these services will be shown as the following:

MSSQL<InstanceName>

SQLAgent<InstanceName>

Use either a Local System account or a domain user account.

If you plan to back up to or restore from an external resource, permissions to the external resource must be granted to the appropriate account. If you use a domain user account for the SQL Server service account, grant permissions to that domain user account. However, if you use the Network Service or the Local System account, grant permissions to the external resource to the machine account (<domain_name>\<SQL_hostname>).

The instance name is arbitrary and was created when SQL Server was installed.

Setup user account

create_sharepoint_setup_account-4

The Setup user account is used to run the following:

Setup

SharePoint Products Configuration Wizard

 

Make setup account as local administrator group

Domain user account.

Member of the Administrators group on each server on which Setup is run.

SQL Server login on the computer that runs SQL Server.

Member of the Server admin SQL Server security role:

If you run Windows PowerShell cmdlets that affect a database, this account must be a member of the db_owner fixed database role for the database.

Server farm account or database access account

create_sharepoint_farml_account-4

The server farm account is used to perform the following tasks:

Configure and manage the server farm.

Act as the application pool identity for the SharePoint Central Administration Web site.

Run the Microsoft SharePoint Foundation Workflow Timer Service.

Domain user account.

Additional permissions are automatically granted for the server farm account on Web servers and application servers that are joined to a server farm.

The server farm account is automatically added as a SQL Server login on the computer that runs SQL Server. The account is added to the following SQL Server security roles:

dbcreator fixed server role

securityadmin fixed server role

db_owner fixed database role for all SharePoint databases in the server farm

5. Install and Configure SQL Server 2012 . You can download SQL Server 2012 : http://www.microsoft.com/betaexperience/pd/SQL2012EvalCTA/enus/default.aspx
Please view my other post about how to install and configure SQL Server 2012 in Windows 2012: http://virtualizesharepoint.com/2012/07/23/install-sql-server-2012-in-windows-server-2012/

6. Create SharePoint Setup, Farm accounts in SQL Server and assign permissions
Click on Windows Key in your keyboard and this is what you will see

image

Right click your mouse anywhere in the window and you will see All apps icon.  Click there to see SQL Management Studio

setting_up_sharepoint_account_in_SQL_2012

7. Open SQL management studio and create SharePoint Installation Accounts (sp_setup, sp_farm)

add_new_login_in_sql_2012_2

add_new_login_in_sql_2012_3

add_new_login_in_sql_2012_4

 

8. Once you create both accounts, logoff ( I used Admin account to create SQL accounts for SharePoint. Now I want to login back as sp_setup to install SharePoint)

login_as_sp_setup_5

In Windows 2012, click on the left arrow

login_as_sp_setup_6

Click on other user

login_as_sp_setup_7

Now login as sp_setup to start the SharePoint 2013 installation

Service Databases in SharePoint 2013


Whare are the services applications with their own Databases in SharePoint 2013?
- App Management Service – New
- Business Data Connectivity
- Managed Metadata Service
- Search
- Secure Store Service
- SharePoint Translation Service – New
- State Service
- Usage and Health Data Collection
- User Profile
- Word Automation Service
- Access Service App Database – New

Follow

Get every new post delivered to your Inbox.

Join 111 other followers